When Evil McJones develops Virus X and initiates its propagation, what events must transpire for AV companies (and AV testing/validation companies) to recognize Virus X?

[This answer to this question](http://security.stackexchange.com/questions/14735/how-antivirus-companies-create-virus-defnitions-for-new-outbreaks) gives a brief list of high-level ways the virus can be found:

> * Samples are sent in by customers
> * Malware detected by heuristic scanners (i.e. stuff that behaves like a virus) is further analysed
> * Mail blocked as spam can be analysed for malware attachments.
> * "honeypots", which are public servers or email addresses designed to collect malware
> * going undercover in malware writers communities

But, what's are the specifics? Are the non-customer initiated means of collecting viruses completely automated? Or, are there N people in a lab trying to contract something?

What heuristics / behaviors lead to a more in depth analysis? And what does the more in-depth analysis consist of? What's the "final marker" of a virus?

... And who names the darn thing?